Claude Code v2.1.281 Major Updates - Addition of attribution: false and Enhanced rm -rf Confirmation

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.281 (released 2026-09-23) has been released. Today, I tried out attribution: false, which prevents Claude's commit trailers from being added.

The previous update article is here.

https://dev.classmethod.jp/articles/20260923-cc-updates-v2-1-280/

Update Summary

v2.1.281 includes 176 changes. The breakdown is 105 fixes, 38 improvements, 13 new features, 8 security, 6 performance, and 6 breaking changes, of which 26 are changes for VS Code extension, Claude Code on the web, Claude Tag, and Code Review. Changes that affect default behavior span send now, auto mode, dangerous rm confirmation, Claude apps gateway, and self-hosted runners.

Notable Updates

IAM Role Assumption and Guardrails Support for Bedrock Upstream in Claude Apps Gateway

assume_role and guardrail: {id, version} have been added to the Bedrock upstream in Claude apps gateway.

When assume_role is configured, the gateway calls Bedrock as an IAM role assumed via STS. You can use a role from a different AWS account if needed, and can make it one session per developer. As of 2026-09-24, the official documentation's configuration reference does not yet mention assume_role, and the example of using Bedrock from a different account involves writing explicit credentials in auth.

When guardrail is configured, Amazon Bedrock guardrails are applied to all requests going through that upstream. If you configure it, either configure it on all Bedrock upstreams or none of them.

Below is a configuration example extracting only the upstreams section from gateway.yaml (required sections such as listen and oidc are omitted). The key name for guardrail follows the CHANGELOG notation, and the value format uses placeholders since there is no official documentation for it.

# Excerpt of the upstreams section from gateway.yaml
upstreams:
  # If there are multiple Bedrock upstreams, configure guardrail on all of them
  - name: bedrock-use1
    provider: bedrock
    region: us-east-1
    auth: {}
    guardrail: { id: <guardrail ID>, version: <version> }
  - name: bedrock-usw2
    provider: bedrock
    region: us-west-2
    auth: {}
    guardrail: { id: <guardrail ID>, version: <version> }

Note that AWS documentation states that when using guardrails for foundation model inference, the invoking role needs bedrock:ApplyGuardrail permission in addition to bedrock:InvokeModel and others.

I feel this is a change that expands what can be handled in the gateway configuration for those who want to use Bedrock from a different AWS account or apply guardrails to all requests going through the gateway.

Hide All Commit and PR Attribution at Once with "attribution": false

Writing "attribution": false in settings.json hides all commit and PR attribution. The official documentation guides using an object format that sets commit and pr to empty strings and sessionUrl to false as the way to hide all attribution.

However, older versions of the CLI will skip configuration files containing "attribution": false. Therefore, the CHANGELOG advises keeping the object format for files shared across multiple versions.

// Format available from v2.1.281 onwards
{
  "attribution": false
}

// For files shared across multiple versions of the CLI, keep this object format
{
  "attribution": {
    "commit": "",
    "pr": "",
    "sessionUrl": false
  }
}

While this is convenient for personal configuration files, writing it in a team-shared .claude/settings.json means the entire file will be skipped for members using older CLIs, so I feel it is a setting that requires careful consideration of where it is placed.

Stronger Dangerous rm Confirmation and Auto-Rejection After 2 Minutes

In auto mode and --dangerously-skip-permissions mode, a bug where recursive rm whose target is solely the output of command substitution, such as rm -rf "$(pwd)", was executed without confirmation has been fixed. Confirmation is now required even with a Bash allow rule, and confirmation is only skipped when executed with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1.

Additionally, dangerous rm confirmations in --dangerously-skip-permissions and auto mode now wait 2 minutes for a response, then reject the command with a rewrite hint. This allows unattended sessions to continue without stopping. This behavior can be turned off with CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1.

For those running unattended with auto mode or --dangerously-skip-permissions, dangerous rm confirmations will no longer cause indefinite stops, but since Claude will continue working after a rejection 2 minutes later with the rewrite hint, I feel it would be good to have logging in place to track unexpected rejections.

claude --bg Now Checks Workspace Trust First

A bug where claude --bg would start a background session in a directory that had not passed workspace trust verification and execute that project's hooks has been fixed. Trust is now verified first, and the process exits if run non-interactively.

For those launching claude --bg from scripts, it will now exit for directories where trust has not been confirmed, so it seems necessary to ensure workspaces are trusted in advance.

send now Now Moves Running Tools to Background

send now (ctrl+enter or ctrl+x ctrl+s) now moves running tools to the background instead of canceling the turn. As of 2026-09-24, the official documentation describes send now (chat:sendNow) as an operation that interrupts the running turn and immediately sends the queued message.

For those who were using send now intending to stop running tools, I feel it is necessary to revisit how you use it, given that tools will continue running in the background.

auto Mode Server-Side Review Now Waits for Read-Only Commands Too

In auto mode for environments where server-side classifier review is performed, read-only shell commands and shell commands inside sandboxes now also wait for that review. If the review finds a problem, they are blocked.

According to the official documentation, server-side classifier review in auto mode is requested for Enterprise plan and Claude API accounts, Claude Platform on AWS, Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, and when ANTHROPIC_BASE_URL is pointed at an LLM gateway or proxy.

In auto mode for these environments, read-only commands will also wait for review and may be blocked depending on the judgment, so I imagine there may be cases where command execution feels slower than before.

Update Details

New Features

• The desktop block in Claude apps gateway policies now supports new Claude Desktop keys. You can configure blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode
• telemetry.resource_attributes has been added to Claude apps gateway configuration. Fixed labels can be attached to telemetry for Claude Desktop and /login sessions
• URL-mode elicitation is now supported for MCP servers connected using the 2026-07-28 version of the protocol. Servers can ask Claude Code to open a flow in the browser. If the server has no way to confirm completion, the waiting dialog will not remain on screen
• MCP server checks have been added to claude plugin validate. It reports .mcp.json entries that are silently dropped at load time, undeclared ${user_config.*} references, and unsafe URLs
• auto mode recommendations have been added to /insights. It estimates how many permission prompts from recent sessions could have been handled by auto mode
• Scrollbars similar to those in /workflows have been added to the Installed list in /skills, /mcp, and /plugin fullscreen mode. They appear while the mouse is over the list and can be operated by clicking or dragging
• [VS Code] When auto mode falls back to a billable classifier request, a Continue/Stop prompt now appears in VS Code and JetBrains panels. This replaces the warning line that could not be answered
• [Claude Code on the web] A Fast mode toggle has been added to the model menu in the compose area for cloud sessions. It appears when the plan includes fast mode and the selected model supports it. Additionally, shortcuts to open the GitHub connection page and a "Troubleshoot GitHub connection" link have been added to GitHub setup hints and the repository picker
• [Claude Tag] After Stop is pressed, a short line appears in the Slack thread indicating who stopped Claude's response and that @Claude should be mentioned to continue

Improvements

• Recovery from "Prompt is too long" has been improved for sessions dominated by a very large initial prompt. That prompt is now summarized on its own rather than being excluded from summarization
• The auto mode rejection message has been improved, and Claude now treats a rejection as applying to the consequences of the command, not just the command itself
• --agents now accepts a JSON file path in addition to inline JSON (when used with -p), and an empty prompt is also now allowed
• /batch can now run not only inside git repositories, but also in environments where a WorktreeCreate hook provides the agent's worktree
• Errors when a plugin hook fails now indicate the plugin that caused it. Also, claude plugin validate now warns when ${CLAUDE_PLUGIN_ROOT} is not quoted in shell-format hooks (as this breaks with plugin paths containing spaces)
• On macOS, when a local development server cannot bind to a port, Claude now guides you to sandbox.network.allowLocalBinding
• In the / menu, /skills, /context, and the /plugin Installed list, skills synced from claude.ai are now displayed with a short name rather than anthropic-skills:<name>, as long as no other command uses that name
• The startup notification about large CLAUDE.md files now also evaluates the total of instruction files, and detects cases where there are many moderately-sized files and @ imports
• Debug logs now show env variables from settings that were ignored because they were already set in the session's launch environment
• Queued messages are now displayed in the conversation above the spinner, rather than below it
• The artifact links that were below the prompt have been consolidated into a single footer pill that opens /artifacts (⧉ name or ⧉ N), and /artifacts now shows this session's artifacts first. The Artifact tool now allows loading unpkg.com scripts on artifact pages. The text on published pages (the bundled artifact-design skill requests plain and direct text) and publishing on slow connections (compressing and uploading large pages) have also been improved
• The MCP resource list (resource list tool and @ mention candidates) no longer includes UI resources from MCP Apps. Reading by specifying a URI is still possible
• In the background task list (/tasks), pressing x on a running /ultrareview now asks for confirmation before stopping the review
• Claude Desktop sign-in and usage limit error messages now guide to the app rather than terminal commands
• In addition, key operations in tabbed dialogs (/permissions, /usage, /help, /sandbox, etc.), display in lists and detail screens of /workflows, /mcp, /skills, /plugin, /diff, and /hooks, line display in narrow terminals, screen reader narration, Remote Control confirmation, and /deep-research reliability have been improved
• [Claude Code on the web] File cards when a cloud session cannot open a file now indicate whether the file no longer exists or whether reading is blocked by the session's permission settings
• [Claude Tag] The list of routines Claude returns when asked in a Slack thread now shows scheduled tasks for that thread by default, rather than all routines in the channel

Performance

• Startup time in interactive mode has been improved. Git reads, startup telemetry, and Bedrock/Vertex model upgrade checks are no longer performed before the first screen is rendered
• Time to resume long sessions that have read many files has been improved. Restored file cache now matches the file contents at the time they were read
• Time to resume very long compacted sessions has been improved. This is especially noticeable via Agent SDK and Claude Desktop
• In auto mode after resuming a session in a new process, the permission classifier can now reuse the previous prompt cache without rewriting it
• Managed configuration and policy retrieval at startup no longer retries requests that cannot succeed
• Remote Control attachment downloads now reuse connections and skip files already downloaded within the session

Security

• Dangerous rm checks have been strengthened and now detect deletions where a shell variable is followed by a top-level directory name, deletions using variables derived from the working directory, and deletions with only a backslash as the target
• A bug where permission dialogs and attachment checks would read paths under macOS /.vol, /.nofollow, and /.resolve (which can reach network mounts) before approval has been fixed
• A bug where permission rules containing NUL bytes were expanded as wildcards has been fixed. Such rules will no longer match anything
• A bug where --setting-sources (SDK's settingSources) was not inherited by launched sessions has been fixed. Teammate, /bg, claude agents sessions, and --worktree --tmux now start with the same restrictions as the parent
• A bug where mcp_tool hooks for blocking events (such as PreToolUse) were skipped while that MCP server was connecting has been fixed. They now wait for the connection, up to the MCP connection timeout
• A bug where --channels plugin entries were only matched against the marketplace of installed plugins has been fixed. Installed plugin names must now also match the entry

Fixes (Major)

• Fixed --max-turns being ignored: A bug where turns could retry indefinitely ignoring --max-turns when the model alternated between unparseable tool calls and truncation due to output limits has been fixed
• Fixed history issues on session resume: A bug where a resumed session would resend content from previous turns in a different form (turns with parallel tool calls, MCP tool call inputs or tool lookup results during reconnection, etc.), causing the API to sometimes drop prior reasoning in the conversation, has been fixed. A bug where only the last few messages were restored when resuming a very large session has also been fixed. Additionally, when resuming a session that ended in the middle of a tool call, Claude now recognizes that call and can be told the result is unknown, and a hidden "Continue" message is no longer added on manual resume
• Fixed stream issues through proxies and gateways: A bug where responses cut off mid-stream by proxies or gateways that close streams normally were shown as complete without warning, and a bug where duplicate stream events caused tool calls to be executed twice, have been fixed. A bug where dropping stream events mid-response by a proxy caused failure with "Content block not found" has also been fixed, and partial responses are now preserved
• Fixed conversation stalling due to tool names that are too long: A bug where a conversation would permanently stall with "tool_use.name: String should have at most 200 characters" after the model called a tool with a name that was too long has been fixed
• Fixed stream-json sessions failing every turn: A bug where --input-format stream-json sessions (Agent SDK, VS Code extension) and scheduled cloud sessions would fail with an error every turn when the content of a previous assistant message was a plain string has been fixed
• Fixed waiting for managed configuration at startup: A bug where interactive mode startup would wait for a managed configuration network request (approximately 80ms, or 17+ seconds if the network was unreachable) when no MCP servers or plugins were configured has been fixed
• Fixed slow responses with large PDFs: A bug where reading or @ mentioning PDFs over 3MB could cause up to a 2-minute delay before a response has been fixed
• Fixed double sending of CLAUDE.md: A bug where CLAUDE.md and rules files in --add-dir directories within the working directory were sent to the model twice in headless and SDK sessions has been fixed
• Fixed refiring of scheduled tasks and /loop: A bug where failed-to-deliver scheduled tasks and /loop wakeups would refire every second, potentially causing Claude Code to exit at the end of a turn, has been fixed
• Fixed disappearing MCP OAuth tokens in macOS Keychain: A bug where writing credentials on macOS would erase saved MCP OAuth tokens or delete keychain entries when the login keychain was locked (such as immediately after waking from sleep) has been fixed
• Subtly satisfying fixes: A bug where pressing Ctrl+C or Ctrl+D twice in remaining dialogs and pickers (/memory, /hooks, /mcp (including the server sign-in screen), /export, /copy, /theme, /teleport uncommitted changes and login prompts, etc.) would exit Claude Code instead of closing the dialog has been fixed. I find this a subtly helpful fix that makes it easier to avoid accidentally ending a session when you intended to close a dialog
• In addition, numerous minor bugs have been fixed in plugins (claude plugin and /plugin), vim mode, the agent panel, fullscreen display and key operations, Windows, VS Code extension, Claude Code on the web, Claude Tag, and more

Breaking Changes and Deprecations

Change in send now Behavior

send now (ctrl+enter or ctrl+x ctrl+s) now moves running tools to the background instead of canceling the turn. The before state reflects the official documentation as of 2026-09-24.

Before (up to v2.1.280):

ctrl+enter / ctrl+x ctrl+s (send now) → Interrupts the running turn and immediately sends the queued message

After (v2.1.281 and later):

ctrl+enter / ctrl+x ctrl+s (send now) → Moves running tools to the background (does not cancel the turn)

Expanded Scope of Server-Side Review in auto Mode

In auto mode for environments where server-side classifier review is performed, read-only shell commands and shell commands inside sandboxes now also wait for that review. The following is organized from the CHANGELOG.

Before (up to v2.1.280):

Read-only / in-sandbox shell commands → Execute without waiting for server-side review

After (v2.1.281 and later):

Read-only / in-sandbox shell commands → Wait for server-side review, and are blocked if a problem is found

CLAUDE_CODE_AUTO_MODE_SERVER Now Applies to Direct Connections to the Anthropic API

CLAUDE_CODE_AUTO_MODE_SERVER now applies to direct connections to the Anthropic API as well. Setting it to 0 disables the server-side auto mode classifier (in which case the local classifier counts toward usage), and setting it to 1 enables it. As of 2026-09-24, the official documentation states that this environment variable is not read for direct connections to the Anthropic API.

If you have this environment variable set while connecting directly to the Anthropic API, the setting will take effect starting from v2.1.281. Below is a configuration example.

# Environment connecting directly to the Anthropic API
export CLAUDE_CODE_AUTO_MODE_SERVER=0

Before (up to v2.1.280):

CLAUDE_CODE_AUTO_MODE_SERVER is not read for direct connections

After (v2.1.281 and later):

CLAUDE_CODE_AUTO_MODE_SERVER=0 → Do not use the server-side auto mode classifier (local classifier counts toward usage)
CLAUDE_CODE_AUTO_MODE_SERVER=1 → Use the server-side auto mode classifier

Dangerous rm Confirmation Rejected After 2 Minutes

Dangerous rm confirmations in --dangerously-skip-permissions and auto mode now wait 2 minutes for a response, then reject the command with a rewrite hint. The following is organized from the CHANGELOG.

Before (up to v2.1.280):

Dangerous rm confirmation → Confirmation continues until answered

After (v2.1.281 and later):

Dangerous rm confirmation → Rejected after 2 minutes (with rewrite hint)

To disable the 2-minute rejection, set the following environment variable.

export CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1

Claude Apps Gateway Refuses to Start Based on envHelper Path

If the envHelper path in a managedMcpServers entry starts with \??\ or /??/, the Claude apps gateway will now refuse to start. This is the path format that the current Claude Desktop refuses to execute. The following is organized from the CHANGELOG.

Before (up to v2.1.280):

envHelper path starts with \??\ or /??/ → Gateway starts

After (v2.1.281 and later):

envHelper path starts with \??\ or /??/ → Gateway refuses to start

How System Prompts Are Passed for Self-Hosted Runners

Self-hosted runners are a mechanism for running Claude Code cloud sessions on your own machines or containers rather than Anthropic's servers. They now pass system prompts to Claude Code as a private file rather than as command-line text, preventing startup failures with large prompts. Wrappers or command hooks that append --system-prompt or --append-system-prompt need to switch to --system-prompt-file or --append-system-prompt-file.

Below is an example wrapper script. The trailing exec "$CLAUDE_RUNNER_CLAUDE_BIN" "$@" follows the official documentation's guidance on how to write wrappers.

Before (up to v2.1.280):

#!/bin/bash
# /etc/claude/session-wrapper.sh
exec "$CLAUDE_RUNNER_CLAUDE_BIN" "$@" --append-system-prompt "Please follow internal coding standards."

After (v2.1.281 and later):

#!/bin/bash
# /etc/claude/session-wrapper.sh
# Write "Please follow internal coding standards." in /etc/claude/extra-prompt.txt
exec "$CLAUDE_RUNNER_CLAUDE_BIN" "$@" --append-system-prompt-file /etc/claude/extra-prompt.txt

Trying Out attribution: false, Which Prevents Claude's Commit Trailers from Being Added

I confirmed that "attribution": false prevents commit trailers from being added, comparing it against the default configuration and the object format.

The verification environment is Claude Code v2.1.281 (macOS). I created 4 git repositories directly under the project, each with hello.txt staged, and had claude -p commit them. I added --setting-sources project to prevent attribution settings in the user configuration (~/.claude/settings.json) from mixing into the results, and --allowedTools "Bash(git commit *)" to allow only commits.

Repository preparation (run directly under the project):

% mkdir repo-default repo-false repo-object repo-project
for r in repo-default repo-false repo-object repo-project; do (cd $r && git init -q && git config user.name "tester" && git config user.email "tester@example.com" && echo "hello" > hello.txt && git add hello.txt); done

% mkdir repo-project/.claude && echo '{"attribution": false}' > repo-project/.claude/settings.json

Only repo-project has "attribution": false written in .claude/settings.json in advance.

Default (no attribution setting):

% cd repo-default
% claude -p "Please commit the staged changes with the message 'Add hello.txt'. Do not run any commands other than git commit." --max-turns 1 --setting-sources project --allowedTools "Bash(git commit *)" < /dev/null
% git log -1 --format=%B
Add hello.txtd max turns (1)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Specifying "attribution": false with --settings:

% cd ../repo-false
% claude -p "Please commit the staged changes with the message 'Add hello.txt'. Do not run any commands other than git commit." --max-turns 1 --setting-sources project --settings '{"attribution": false}' --allowedTools "Bash(git commit *)" < /dev/null
% git log -1 --format=%B
Add hello.txtd max turns (1)

Specifying the object format with --settings:

% cd ../repo-object
% claude -p "Please commit the staged changes with the message 'Add hello.txt'. Do not run any commands other than git commit." --max-turns 1 --setting-sources project --settings '{"attribution": {"commit": "", "pr": "", "sessionUrl": false}}' --allowedTools "Bash(git commit *)" < /dev/null
% git log -1 --format=%B
Add hello.txtd max turns (1)

When "attribution": false is written in .claude/settings.json:

% cd ../repo-project
% cat .claude/settings.json
% claude -p "Please commit the staged changes with the message 'Add hello.txt'. Do not run any commands other than git commit." --max-turns 1 --setting-sources project --allowedTools "Bash(git commit *)" < /dev/null
% git log -1 --format=%B
{"attribution": false}
Add hello.txtd max turns (1)

The results are summarized as follows.

All executions ended with Error: Reached max turns (1) indicating the --max-turns 1 limit was reached (exit code 1), but as shown by git log, commits were created in all cases. The default trailer included Claude Opus 5.5 (1M context) as the session's model name. PR attribution and the behavior of older CLI versions skipping configuration files were not verified this time.

In the commits I tried, trailers were not added with either false or the object format. I feel that using the object format for shared configuration files where CLI versions are not aligned, and using false for personal configuration files, is a good approach.

Closing

This release has 176 changes, a large number with most being fixes, but behaviors related to unattended execution and how operations feel — such as dangerous rm confirmation, send now, and server-side review in auto mode — have changed. I feel that those running Claude Code in auto mode or with --dangerously-skip-permissions especially should verify the behavior once after updating.

Whether you want to clean up commit attribution or run unattended in auto mode, why not update and give it a try?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260923-cc-updates-v2-1-280/